agent-dag 3.0.0 → 3.2.0

package/src/server/quota.mjs

@@ -528,6 +528,37 @@ async function nudgeAndReread(previous) {
 //   cliOk  — the CLI ran and we recognized its output (preamble present)
 //   parsed — quota percentages object, or null if the "Current session/week"
 //            lines were absent (CLI cold-start, or genuinely <1% usage)
+/**
+ * The failure this last said out loud, so a standing one is said once.
+ *
+ * #742. A Windows user with no Claude Code installed sent a screenshot of three
+ * identical lines — `ccdeck quota: claude CLI failed: claude exited ENOENT` —
+ * interleaved with the deck's pulse line, and they keep coming for as long as
+ * the deck runs. Every poll ran the loop below three times, and every attempt
+ * printed. A CLI that is not installed is not news three times a minute; it is
+ * a condition, and a condition is worth exactly one line.
+ *
+ * Cleared on the first run that works, so a `claude` installed while the deck
+ * is up can still report its next genuine failure.
+ */
+let _saidFailure = null;
+
+/** Exported for its test, and for the same reason resetCswapBin is: a module
+ *  that remembers something across calls needs a way to be asked twice.
+ *
+ *  Deliberately NOT folded into invalidateQuotaCache, which production calls
+ *  after an account switch — forgetting the notice there would put the same
+ *  sentence back on the terminal every time somebody changed accounts. */
+export function forgetQuotaFailureNotice() { _saidFailure = null; }
+
+/** The rate floor, cleared. `maySelfPoll` keeps a self-poll to one a minute
+ *  even under `force`, which is correct for a user's budget and is a test
+ *  asking the same question three times running into a wall. */
+export function resetQuotaPollFloor() {
+  _lastSelfPollAt = 0;
+  _rateLimitedUntil = 0;
+}
+
 async function _execOnce(bin) {
   const r = await run(bin, ["--print", "/usage"], {
     timeout: 15_000,
@@ -543,12 +574,22 @@ async function _execOnce(bin) {
   // is kept either way, which matters because the CLI writes the quota lines to
   // stdout and can still exit non-zero afterwards.
   const combined = r.stdout + "\n" + r.stderr;
+  // `run` normalises a binary that is not there to this, on every platform —
+  // see exec.mjs. It is the difference between "Claude Code answered badly",
+  // which is worth retrying and worth saying, and "there is no Claude Code on
+  // this machine", which is neither.
+  const missing = r.code === "ENOENT";
   if (!r.ok) {
     const msg = stripAnsi(r.stderr).trim() || `claude exited ${r.code}`;
-    console.error(`${PRODUCT} quota: claude CLI failed:`, msg);
+    if (msg !== _saidFailure) {
+      _saidFailure = msg;
+      console.error(`${PRODUCT} quota: claude CLI failed:`, msg);
+    }
+  } else {
+    _saidFailure = null;
   }
   const cliOk = /subscription/i.test(combined) || /claude code usage/i.test(combined);
-  return { cliOk, parsed: parseUsageText(combined) };
+  return { cliOk, missing, parsed: parseUsageText(combined) };
 }
 
 async function _doFetch(now, force = false, gen = _generation) {
@@ -607,6 +648,11 @@ async function _doFetch(now, force = false, gen = _generation) {
     const r = await _execOnce(bin);
     cliOk = r.cliOk || cliOk;
     if (r.parsed) { parsed = r.parsed; break; }
+    // The retry exists for a CLI that RAN and left the quota lines out of a cold
+    // invocation. A CLI that is not installed will not be installed 1.2 seconds
+    // from now, and asking twice more spends two spawns and 2.4 seconds of the
+    // caller's wait to print the same sentence three times. See _execOnce.
+    if (r.missing) break;
   }
 
   // Got real quota lines — cache normally and remember as last-known-good.

package/src/server/system-metrics.mjs

@@ -663,11 +663,37 @@ async function readProcessesNow(platform) {
 //            Intel-only and an undocumented scale, and printing it as though it
 //            were degrees would be exactly the lie this module refuses.
 //
-//   Windows  MSAcpi_ThermalZoneTemperature in root/wmi, CurrentTemperature in
-//            TENTHS OF A KELVIN. Published by the firmware and genuinely absent
-//            on a large share of desktop boards — the same lesson
-//            parseGetProcessJson learned about perflib, which is why absent is
-//            ordinary here rather than an error.
+//   Windows  The performance counter `\Thermal Zone Information(*)\High
+//            Precision Temperature`, in TENTHS OF A KELVIN, read through
+//            Get-Counter.
+//
+//            It is read through a counter rather than through WMI for one
+//            reason, and it is the reason this section never worked on Windows
+//            for anybody: MSAcpi_ThermalZoneTemperature lives in root\wmi and
+//            that namespace REQUIRES ADMINISTRATOR. A deck started from an
+//            ordinary terminal — which is every deck, since v1 must never need
+//            admin rights — got Access Denied, three times, and then gave up
+//            for the life of the process. The section was not missing because
+//            the hardware was silent; it was missing because we were asking
+//            somewhere we were not allowed to look.
+//
+//            MSAcpi is still asked, second, because a deck that IS elevated can
+//            read it and because the two do not always agree — some boards
+//            publish a zone to ACPI and no counter.
+//
+//            Genuinely absent on a large share of machines either way: a
+//            desktop board with no zone, and every virtual machine, which has
+//            no thermal hardware to report. Measured on a QEMU/SeaBIOS guest:
+//            the counter set is registered and answers "The specified instance
+//            is not present", and MSAcpi answers "Not supported" even to an
+//            administrator. Absent is ordinary here rather than an error.
+//
+//            THE COUNTER PATH IS LOCALISED. `Thermal Zone Information` is the
+//            English name and a German or French Windows publishes its own, so
+//            this reaches the counter on an English install and falls through
+//            to MSAcpi elsewhere. Translating it means resolving a numeric
+//            index through the registry, which is a change with no way to be
+//            tested from here — see #747.
 //
 // NEVER INVENT A READING. No sensor means no row, and no rows at all means the
 // section is not rendered: not 0°C, not a dash, not a grey empty bar. Same rule
@@ -882,11 +908,96 @@ export function throttleFromPmset(text) {
   return { speedLimit: pct };
 }
 
+
+/**
+ * Windows thermal zones out of the `Thermal Zone Information` counter set.
+ *
+ * `High Precision Temperature` is in TENTHS OF A KELVIN, which is the single
+ * detail this branch turns on — the same unit MSAcpi uses below, and reading it
+ * as anything else gives a number that is plausible-looking and wrong.
+ *
+ * This is the source that works WITHOUT ADMINISTRATOR, which is the whole point
+ * of it: root\wmi needs elevation and a deck never has it. See the note at the
+ * top of this section.
+ *
+ * Shape is `[{ i: instanceName, v: cookedValue }]` — the projection the
+ * PowerShell one-liner makes, so this parser never has to know what a
+ * CounterSample looks like.
+ */
+export const WIN_THERMAL_PS = [
+  "$r = [ordered]@{}",
+  // Get-Counter, not Get-CimInstance: this is the half that works unelevated.
+  "try { $r.perf = @((Get-Counter -Counter '\\Thermal Zone Information(*)\\High Precision Temperature' -EA Stop).CounterSamples | ForEach-Object { @{ i = $_.InstanceName; v = $_.CookedValue } }) } catch {}",
+  "if (-not $r.perf) { try { $r.acpi = @(Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | ForEach-Object { @{ i = $_.InstanceName; v = $_.CurrentTemperature } }) } catch {} }",
+  // Depth matters: the default of 2 turns the inner hashtables into the string
+  // "System.Collections.Hashtable" and this parser would see nothing at all.
+  "$r | ConvertTo-Json -Compress -Depth 4",
+].join("; ");
+
+/**
+ * Whichever of the two Windows sources answered, as thermal rows.
+ *
+ * The shape is `{ perf: [...] }` or `{ acpi: [...] }` or `{}` — the PowerShell
+ * above only ever fills one, and fills neither on the machines where there is
+ * nothing to fill it with. Both lists carry the same two fields and the same
+ * unit, so the only thing that differs is which key they arrived under.
+ */
+export function parseWinThermal(json) {
+  let r;
+  try { r = typeof json === "string" ? JSON.parse(json) : json; }
+  catch { return []; }
+  if (!r || typeof r !== "object") return [];
+  const perf = tempFromPerfCounterJson(r.perf ?? []);
+  if (perf.length) return perf;
+  return tempFromPerfCounterJson(
+    // MSAcpi's projection uses the same two keys, so the one parser reads both.
+    Array.isArray(r.acpi) ? r.acpi : (r.acpi ? [r.acpi] : []),
+  );
+}
+
+export function tempFromPerfCounterJson(json) {
+  let rows;
+  try { rows = typeof json === "string" ? JSON.parse(json) : json; }
+  catch { return []; }
+  if (!rows) return [];
+  if (!Array.isArray(rows)) rows = [rows];
+  const found = [];
+  for (const r of rows) {
+    const tenths = Number(r?.v);
+    if (!Number.isFinite(tenths)) continue;
+    const celsius = Math.round(tenths / 10 - 273.15);
+    if (!plausible(celsius)) continue;
+    found.push({ label: zoneLabel(r?.i), celsius, warnAt: WARN_C, critAt: CRIT_C });
+  }
+  if (found.length === 1) found[0].label = "Thermal zone";
+  return found.slice(0, 2);
+}
+
+/**
+ * A thermal zone's name, out of whatever spelling the source used.
+ *
+ * The counter names its instances `\_tz.tz00` and WMI names the same zone
+ * `ACPI\ThermalZone\TZ00_0`, so the tail after the last separator is the only
+ * part the two agree on. Upper-cased because the counter lower-cases it and a
+ * panel that showed `tz00` beside a `TZ01` from the other source would be
+ * showing one machine as two.
+ */
+export function zoneLabel(raw) {
+  const tail = String(raw ?? "").split(/[\\.]/).pop() ?? "";
+  const name = tail.replace(/_\d+$/, "").toUpperCase();
+  return name || "Thermal zone";
+}
+
 /**
  * Windows thermal zones out of MSAcpi_ThermalZoneTemperature.
  *
- * CurrentTemperature is in tenths of a Kelvin, which is the single detail this
- * whole branch turns on: reading it as anything else gives a number that is
+ * The SECOND source, and only reachable by a deck that happens to be elevated:
+ * root\\wmi requires administrator and refuses an ordinary terminal outright.
+ * Kept because some boards publish a zone to ACPI and no counter, and because a
+ * deck launched from an elevated shell can read it.
+ *
+ * CurrentTemperature is in tenths of a Kelvin, the same unit as the counter
+ * above, and reading it as anything else gives a number that is
  * plausible-looking and wrong.
  *
  * The zone is labelled "Thermal zone" when there is one and by its own name
@@ -906,13 +1017,37 @@ export function tempFromMsAcpiJson(json) {
     if (!Number.isFinite(k)) continue;
     const celsius = Math.round(k / 10 - 273.15);
     if (!plausible(celsius)) continue;
-    const name = String(r?.InstanceName ?? "").split("\\").pop().replace(/_\d+$/, "");
-    found.push({ label: name || "Thermal zone", celsius, warnAt: WARN_C, critAt: CRIT_C });
+    found.push({ label: zoneLabel(r?.InstanceName), celsius, warnAt: WARN_C, critAt: CRIT_C });
   }
   if (found.length === 1) found[0].label = "Thermal zone";
   return found.slice(0, 2);
 }
 
+/**
+ * The macOS rows, from whatever the three sources answered.
+ *
+ * Pure, and exported, for the reason sampleThermal's `deps.read` is: the branch
+ * that matters only fires on a machine that answers with nothing, and the
+ * machine this was written on answers with something. There is no other way to
+ * run it.
+ *
+ * The ordering rule is the whole content. ioreg's GPU degrees and pmset's
+ * throttle are what macOS itself gives up, and they win — they cost one cheap
+ * subprocess each and they are the same numbers this deck has always shown.
+ * macmon is consulted only when both were silent, and then its CPU row comes
+ * first, because on the machine that reaches here the CPU is the reading
+ * somebody opened the panel for.
+ */
+export function darwinThermal({ gpuC = null, throttle = null, macmon = {} } = {}) {
+  const celsius = [];
+  if (gpuC != null) celsius.push({ label: "GPU", celsius: gpuC, warnAt: WARN_C, critAt: CRIT_C });
+  else {
+    if (macmon.cpu != null) celsius.push({ label: "CPU", celsius: macmon.cpu, warnAt: WARN_C, critAt: CRIT_C });
+    if (macmon.gpu != null) celsius.push({ label: "GPU", celsius: macmon.gpu, warnAt: WARN_C, critAt: CRIT_C });
+  }
+  return celsius.length || throttle ? { celsius, throttle } : null;
+}
+
 /**
  * What /api/system carries, or null when this machine says nothing at all.
  *
@@ -937,21 +1072,45 @@ export async function readThermal(platform = process.platform) {
       run("ioreg", ["-r", "-k", "PerformanceStatistics", "-w", "0"], 3_000),
       run("pmset", ["-g", "therm"]),
     ]);
-    const celsius = [];
-    const c = gpu ? gpuFromIoreg(gpu) : null;
-    if (c != null) celsius.push({ label: "GPU", celsius: c, warnAt: WARN_C, critAt: CRIT_C });
+    const gpuC = gpu ? gpuFromIoreg(gpu) : null;
     const throttle = therm ? throttleFromPmset(therm) : null;
-    return celsius.length || throttle ? { celsius, throttle } : null;
+
+    // Nothing from either is every Apple Silicon Mac, and only those: the AGX
+    // driver does not publish the key ioreg reads, and pmset records no speed
+    // limit on M-series. Asking macmon is the only thing left, and it is asked
+    // ONLY here — an Intel Mac answers above and never spawns it. See
+    // macmon.mjs for why a tool the user installed is the whole of the answer.
+    const macmon = gpuC == null && !throttle
+      ? await (await import("./macmon.mjs")).readMacmonTemps()
+      : {};
+
+    return darwinThermal({ gpuC, throttle, macmon });
   }
 
   if (platform === "win32") {
+    // One child for both sources rather than two, because the cost here is the
+    // PowerShell start and not the queries: the counter is tried first because
+    // it needs no administrator, and MSAcpi only when the counter said nothing.
+    // Both are wrapped in their own try — "no thermal zone on this machine" is
+    // the ordinary answer and arrives as a throw from either.
     const out = await run("powershell.exe", [
-      "-NoProfile", "-NonInteractive", "-Command",
-      "Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction Stop | Select-Object InstanceName,CurrentTemperature | ConvertTo-Json -Compress",
+      "-NoProfile", "-NonInteractive", "-Command", WIN_THERMAL_PS,
     ], 6_000);
-    if (!out) return null;
-    const celsius = tempFromMsAcpiJson(out.trim());
-    return celsius.length ? { celsius, throttle: null } : null;
+    const answer = out ? parseWinThermal(out.trim()) : [];
+    if (answer.length) return { celsius: answer, throttle: null };
+
+    // Windows itself had nothing, which on a modern Intel laptop is every time:
+    // the firmware declares no ACPI thermal zone and the sensors sit behind
+    // Intel DTT, which an ordinary process may not read. If something on this
+    // machine has already gone and got them — LibreHardwareMonitor, with its
+    // web server on — they are a plain HTTP read away. Never installed, never
+    // asked for. See hwmonitor.mjs.
+    const { readHwMonitorTemps } = await import("./hwmonitor.mjs");
+    const t = await readHwMonitorTemps();
+    const rows = [];
+    if (t.cpu != null) rows.push({ label: "CPU", celsius: t.cpu, warnAt: WARN_C, critAt: CRIT_C });
+    if (t.gpu != null) rows.push({ label: "GPU", celsius: t.gpu, warnAt: WARN_C, critAt: CRIT_C });
+    return rows.length ? { celsius: rows, throttle: null } : null;
   }
 
   return null;
@@ -1186,11 +1345,45 @@ export async function sampleThermal(deps = {}) {
         clearInterval(thermalTimer);
         thermalTimer = null;
       }
+      // The one machine where "nothing" is worth doing something about: an
+      // Apple Silicon Mac has sensors and no way to read them, and the tool
+      // that can is a 746 KB signed binary this deck can fetch. Started HERE
+      // rather than at boot on purpose — the boot was just taught not to wait
+      // for an install (#742) and nothing waits for this one either. One
+      // attempt per process, and only after the give-up, so a machine that
+      // does have a sensor never downloads anything. See macmon.mjs.
+      if (!thermalEverAnswered && process.platform === "darwin") fetchMacmon(deps);
     }
   } catch { thermalMisses++; }
   finally { thermalInFlight = false; }
 }
 
+/**
+ * Fetch macmon, then ask again — floating, on purpose.
+ *
+ * Not awaited by sampleThermal, which is itself not awaited by anything: this
+ * is a download that may take a minute on a slow line, and the panel it serves
+ * is optional. When it lands, the give-up above has already stopped the timer,
+ * so the retry has to be made here rather than waited for.
+ */
+function fetchMacmon(deps = {}) {
+  const boot = deps.bootstrap ?? (async () => (await import("./macmon.mjs")).bootstrapMacmon());
+  Promise.resolve(boot()).then(r => {
+    if (!r?.ok) return;
+    // A sensor exists after all. Clear the give-up and let the timer run again,
+    // which is what turns a downloaded binary into a section on screen without
+    // the user restarting anything.
+    thermalMisses = 0;
+    if (!thermalTimer) {
+      thermalTimer = setInterval(() => { sampleThermal(deps); }, THERMAL_INTERVAL_MS);
+      // Unref'd like the one startSystemMetrics creates: a poll for an optional
+      // panel must not be the reason a process refuses to exit.
+      thermalTimer.unref?.();
+    }
+    sampleThermal(deps);
+  }).catch(() => {});
+}
+
 async function sampleMemory() {
   if (memInFlight) return;
   memInFlight = true;

package/src/server/term.mjs

@@ -217,6 +217,29 @@ export function spinnerFrames(unicode) {
   return unicode ? BRAILLE_FRAMES.slice() : ASCII_FRAMES.slice();
 }
 
+/** When a spinner starts saying how long it has been going.
+ *
+ *  #742: a spinner four seconds in looks exactly like one four hundred
+ *  milliseconds in, and that is the whole of "is this thing stuck". A number
+ *  answers it. Three seconds, because under that the number would be on screen
+ *  for a blink on every ordinary boot and would be noise rather than an answer
+ *  — nobody doubts a step that has not yet lasted as long as it takes to doubt
+ *  one. */
+export const SPINNER_ELAPSED_AFTER_MS = 3_000;
+
+/**
+ * The seconds a spinner shows beside its label, or "" while it is too young to
+ * have anything worth saying.
+ *
+ * Whole seconds, floored, and never a tenth: a number that changes ten times a
+ * second is a second spinner rather than an answer about the first one. Here
+ * rather than in bin/deck.js because that file runs a deck when it is imported,
+ * and this is the one part of `step` worth holding still in a test.
+ */
+export function elapsedSuffix(ms, after = SPINNER_ELAPSED_AFTER_MS) {
+  return ms < after ? "" : `  ${Math.floor(ms / 1000)}s`;
+}
+
 // ── motion ───────────────────────────────────────────────────────────────────
 
 /**
@@ -517,12 +540,14 @@ export function wordmark({
  * use. The one-time report at boot still says what IS lost; see
  * unregisteredDetail.
  */
-export function pulseText({ registered = true, claude = true, columns = 80, unicode = true, indent = 2 } = {}) {
+export function pulseText({
+  registered = true, claude = true, columns = 80, unicode = true, indent = 2, busy = null,
+} = {}) {
   const g = glyphs(unicode);
   const room = Math.max(4, columns - indent - 3 - 1);
   const pick = (options) => options.find((o) => o.length <= room) ?? options[options.length - 1].slice(0, room);
 
-  const ok = pick([`listening ${g.dash} Ctrl+C to stop`, "listening"]);
+  const rest = pick([`listening ${g.dash} Ctrl+C to stop`, "listening"]);
   const bad = pick([
     `listening, but not registered ${g.dash} hooks cannot find this deck`,
     `not registered ${g.dash} hooks cannot find this deck`,
@@ -531,10 +556,61 @@ export function pulseText({ registered = true, claude = true, columns = 80, unic
   // Both branches are still measured, registered or not, because the line is
   // redrawn over itself and the shorter message has to cover the longer one on
   // the beat after a deck loses its registration.
-  const width = Math.min(room, Math.max(ok.length, bad.length));
+  //
+  // The width is deliberately computed from the two FIXED messages only. `busy`
+  // comes and goes on a single boot — an install starts, the line names it, the
+  // install ends and the line goes back to Ctrl+C — so a width that grew to fit
+  // the label would have to shrink again afterwards, and the shorter line would
+  // leave the tail of the longer one on screen. Instead the label is shown only
+  // where it already fits — 60 columns and wider, measured — and below that the
+  // line says the true thing it has always said.
+  const width = Math.min(room, Math.max(rest.length, bad.length));
+  // What is still happening, rather than what is always true. `Ctrl+C to stop`
+  // is the right thing to say to somebody with nothing left to wait for, and
+  // the wrong thing to say to somebody watching an install.
+  const label = typeof busy === "string" && busy.trim() ? busy.trim() : null;
+  const working = label ? `listening ${g.bullet} ${label}` : null;
+  const ok = working && working.length <= width ? working : rest;
   return (registered || !claude ? ok : bad).padEnd(width);
 }
 
+/**
+ * Whether the line has anything left to say by moving.
+ *
+ * #742. The dot alternated green and grey every 800ms for as long as the deck
+ * ran, and a blinking indicator beside a status line is the vocabulary of
+ * "working on it" — so a boot that had finished in a second read as one that
+ * never finished, and people said so. The deck's own web UI already retired
+ * this once: the pill goes quiet at rest (#720). The terminal did not.
+ *
+ * Motion is now spent on the two states where something is genuinely
+ * outstanding — a deck no hook can find, and a background job still running —
+ * and nowhere else. At rest the dot is painted once, in the healthy colour, and
+ * left alone. Movement then means something changed, which is the only thing
+ * movement should ever mean on a line somebody leaves open for hours.
+ */
+export function pulseMoves({ registered = true, claude = true, busy = null } = {}) {
+  if (!registered && claude) return true;
+  return typeof busy === "string" && busy.trim() !== "";
+}
+
+/**
+ * Whether the dot is lit on this beat.
+ *
+ * `"on"` on every beat of a deck at rest, which is what makes the line still:
+ * bin/deck.js paints a beat only when the frame differs from the one already on
+ * screen, so a dot that is always lit is a line written once and then left
+ * alone. Alternating is reserved for the states pulseMoves admits.
+ *
+ * The beat is a parameter rather than counted here so this is a function of its
+ * inputs and nothing else — and so a test can ask what the twentieth beat of an
+ * idle deck looks like without waiting sixteen seconds for it.
+ */
+export function pulseDot(beat, { registered = true, claude = true, busy = null } = {}) {
+  if (!pulseMoves({ registered, claude, busy })) return "on";
+  return beat % 2 === 0 ? "on" : "off";
+}
+
 /**
  * The second line of the "not registered" report, which bin/deck.js prints once
  * per change of state rather than every beat.